EUVD-2026-66391Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable app needing only a low-privilege account (PR:L) with no user interaction; command injection escapes the app to the host (S:C) with full host CIA impact.
Primary rating from Vendor (Ubiquiti).
CVSS VectorVendor: Ubiquiti
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
AnalysisAI
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run arbitrary commands on the underlying host. Because the CVSS scope is marked Changed with full High confidentiality, integrity, and availability impact, successful exploitation moves beyond the application into the host device itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the UniFi Access Application and a low-privileged authenticated foothold (PR:L) - a valid low-tier account or access to an authenticated application interface - but no user interaction and only low attack complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged UniFi Access account or reached an authenticated application endpoint over the network submits crafted input into a field that the application passes to a host command without proper validation. The injected shell metacharacters cause arbitrary commands to run on the host device, and with the scope-changed High CIA impact the attacker can pivot to full control of the appliance. … |
| Remediation | Patch available per vendor advisory - apply the fixed UniFi Access Application release referenced in Ubiquiti Security Advisory Bulletin 067 (https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9); the exact fixed version number is not included in the provided data and must be confirmed from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all UniFi Access deployments across the organization and assess network exposure; immediately restrict administrative access to trusted networks only and disable the application if operationally feasible, and subscribe to Ubiquiti security advisories to ensure timely patch notification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Unifi Access Application
View allCommand injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arb
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and networ
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and net
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today